Data Privacy Information for the Accreditation Process for the Matches of Bundesliga and Bundesliga 2 and the Supercup match
DFL Deutsche Fußball Liga e.V., Guiollettstraße 44-46, 60325 Frankfurt am Main, Germany
(“
DFL e.V.”) is required, as a so-called controller within the meaning of the European General Data Protection Regulation
("
GDPR") and the German Data Protection Act (Bundesdatenschutzgesetz, "
BDSG") to comply with provisions in data privacy laws when handling personal data.
Employees and representatives of accreditable media and service providers (“
Applicant/Accredited Person”) are hereby
informed about the collection, storage, processing and use of their personal data within the meaning of Art. 4 no. 2 GDPR
("
Data") by DFL e.V. in the context of the conduction of the accreditation process for the matches of the Bundesliga and Bundesliga 2,
as well as the Supercup match to the extent described below.
All accreditations will be issued as one-day accreditations. The accreditation process for the matches of the Bundesliga and Bundesliga, as well as the Supercup match is carried out by Sportcast GmbH acting as a processor within the meaning of Art. 28 GDPR for DFL e.V. Sportcast GmbH also produces the basic signal of these matches on behalf of DFL e.V. The respective accreditation is issued by the respective home club.
If an Applicant/Accredited Person does submit the accreditation application via a central contact person and not himself or herself, this central contact person must ensure that the available data privacy information is forwarded and provided
Applicants/Accredited Persons are only required to provide the Data required for the decision on issuing the accreditation and its use or which DFL e.V. legally obliged to collect. Without this information, DFL e.V. will usually not be able to consider and review the application for accreditation.
I. Controller, data protection officer
DFL e.V. is the controller.
Applicants/Accredited Persons can contact the data protection officer of DFL Deutsche Fußball Liga GmbH which is responsible for the operative business of DFL e.V. under
dataprivacy@dfl.de.
DFL e.V. processes the Data received from the Applicants/Accredited Persons in the accreditation process.
Relevant Data of the Applicants/Accredited Persons are master data (first and last name, date of birth), contact data, professional status, legitimation data (e.g. media/press ID for proof of full-time status).
III. Purpose and legal basis of the processing, Data recipient
DFL e.V. processes the Data in accordance with the provisions in the GDPR and the BDSG. This means that the Data will only be processed if there is a legal permission (especially if the Data processing is necessary for the decision on issuing the accreditation or is prescribed by law or is based on the legitimate interests of DFL e.V. or third parties), or if the respective Applicant/Accredited Person has given his or her consent in individual cases.
Within DFL e.V., those departments which need the Data to fulfil their contractual and legal obligations receive the Data. Processors engaged by DFL e.V. (Art. 28 GDPR), especially Sportcast GmbH, and other contractors, as well as other Data recipients (especially the respective home club for issuing the accreditation) may also receive Data for these purposes. These could also be companies in the categories of match day and stadium organisation, stadium security, printing and mailing, as well as IT services.
The Applicant’s/Accredited Person’s Data will only be disclosed to recipients outside DFL e.V., if permitted or required to do so by law. Under these prerequisites, recipients of the Data may be, for example, the recipients mentioned above (including other companies affiliated with DFL e.V. within the meaning of §§ 15 seq. AktG, the home club and other third parties).
1. For purposes of the accreditation process, Art. 6 para. 1 b) GDPR
The processing of the Data is carried out for purposes of deciding on issuing the accreditation and its use.
2. In the course of weighing interests, Art. 6 para. 1 f) GDPR
If necessary, DFL e.V. processes the Data in addition of the actual purposes of the accreditation process to protect its legitimate interests or the legitimate interests of third parties. Examples:
| a) |
Production and public distribution of visual and audio-visual recordings of the matches which show the Applicant/Accredited Person in this capacity, as well as the exploitation of these visual and audio-visual recordings for commercial and for non-commercial purposes without any restriction in time and territory either by DFL e.V. and DFL Deutsche Fußball Liga GmbH or third parties designated by them, the home club and the other clubs of the Bundesliga and Bundesliga 2, as well as by clubs from other leagues participating in the Supercup match and licensees and partners of DFL e.V. and DFL Deutsche Fußball Liga GmbH, as well as these clubs (i.e. cooperation, media and marketing partners). The exploitation can take place in every physical form (especially production and dissemination of all digital and analogue media formats) and every non-physical form (especially broadcast, public communication or accessibility, for example, as download or streaming) in all media and on all platforms.
|
|
b)
|
Assertion and exercise of legal claims, as well as defence in legal disputes
|
| c) |
Ensuring IT security and IT operations.
|
Applicants/Accredited Persons have the right to object at any time to the above processing of Data concerning them for reasons arising from their particular situation. If an Applicant/Accredited Person files an objection, DFL e.V. will no longer process his or her Data, unless DFL e.V. can prove compelling legitimate grounds for the processing that outweigh the interests, rights and freedoms of the respective Applicant/Accredited Person or the processing serves to assert and exercise legal claims or to defend legal disputes.
Where required, DFL e.V. processes the Data for the purposes of security checks and transmits Data to the responsible security authorities in the event of a concrete risk situation, if this is necessary
| • |
for the performance of a task carried out in the public interest or in the exercise of official authority vested in DFL e.V. and/or the respective home club (Art. 6 para. 1 e) GDPR); or
|
| • |
to prevent threats to state or public security (§ 24 para. 1 no. 1 BDSG).
|
Applicants/Accredited Persons have the right to object at any time to the above processing of Data concerning them pursuant to Art. 6 para. 1 e) GDPR for reasons arising from their particular situation. If an Applicant/Accredited Person files an objection, DFL e.V. will no longer process his or her Data, unless DFL e.V. can prove compelling legitimate grounds for the processing that outweigh the interests, rights and freedoms of the respective Applicant/Accredited Person or the processing serves to assert and exercise legal claims or to defend legal disputes.
In addition, DFL e.V. is subject to various legal obligations, i.e. legal requirements (e.g. tax laws). The purposes of the processing include, among other reasons, the fulfilment of fiscal control and reporting obligations.
5. Processing based on consent, Art. 6 para. 1 a) GDPR
If the Applicant/Accredited Person gives his or her consent to DFL e.V. to the processing of Data for specific purposes, this processing is lawful on the basis of the consent. A given consent can be withdrawed at any time. The withdrawal is only effective for the future. Processing that took place before the withdrawal is not affected.
IV. Storage period of the Data
If necessary, DFL e.V. processes and stores the Data for the duration of the term of the contract with the respective licensee or service provider for which the Applicant/Accredited Person works, or for the duration of the term of the contract with the Applicant/Accredited Person. Should the Applicant’s/Accredited Person’s employment relationship with the respective licensee or service provider end or a direct contract with him/her should end, the processing, storage and use of his/her Data shall end, contrary to the provisions above and subject to the provisions of the following paragraphs.
The processing, storage and use of the Data by DFL e.V. may in individual cases, depending on the purpose of the storage, also extend the duration of this use, e.g. for the purposes of asserting and exercising legal claims, as well as defending legal disputes.
The Data collected and processed within the scope of the weighing of interests pursuant to Clause III.2. will be stored for as long as this is permitted on the basis of legitimate interests.
Futhermore, DFL e.V. is subject to various retention and documentation obligations, which result, among other reasons, from the German Commercial Code (Handelsgesetzbuch, "HGB") and the German Tax Code (Abgabenordnung, "AO").
V. Further Data transmission to third countries or an international organization
Data is transmitted to third countries (countries outside the European Economic Area - EEA) only if permitted by law (especially if the processing of Data is necessary or required or prescribed by law for conducting the accreditation process and issuing an accreditation or due to legitimate interests of the DFL e.V. (including affiliated companies within the meaning of §§ 15 seq. AktG or other third parties) and under the prerequisites of Artt. 44 to 49 GDPR (e.g. for countries with an appropriate level of data protection in accordance with Art. 45 para. 1 GDPR or if EU Standard Contractual Clauses have been concluded, Art. 46 para. 2 d) in conjunction with Art. 93 para. 2 GDPR).
VI. Data privacy rights of the Applicant/Accredited Person
Applicants/Accredited Persons have the right of access under Art. 15 GDPR in conjunction with §§ 29, 34 BDSG, the right to rectificationunder Art. 16 GDPR, the right to erasure under Art. 17 GDPR in conjunction with § 35 BDSG, the right to restriction of processing under Art. 18 GDPR in conjunction with § 35 BDSG as well as the right to data portability under Art. 20 GDPR. There is also a right to lodge a complaint with a supervisory authority (Art. 77 GDPR).